OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security
C-Rank Grade: A (Welcoming) - 63/100
External PR Merge Rate: 48%
Response Time: 4h
First Timer Success: 19%
openai/codex-security has a recorded first-timer success rate of 18.5%. Repositories ranked A typically provide actionable feedback during code reviews and actively nurture new community contributors.
Maintainers in openai/codex-security respond to incoming external pull requests in approximately 3.7 hours on average. Keeping PRs focused on single tasks and ensuring tests pass helps maintainers review faster.
The C-Rank™ system evaluates GitHub projects on a 0–100 scale using real data: PR merge rates, review turnaround time, active maintainer presence, and first-time contributor success. A score of 63.1 places openai/codex-security in the A tier.
The external contributor pull request merge rate for openai/codex-security is 48.1%, based on public PR activity from non-core contributors.
openai/codex-security does not currently have active "good first issue" tags indexed, but accepts external contributions through standard GitHub issue tracking.
OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security
Strict review standards in openai/codex-security. Ensure PR scope matches issue requirements closely before requesting review.
Average Response Latency
Tracks hours until a maintainer leaves a review, comment, or PR response.
External Acceptance Rate
Percentage of community pull requests successfully merged into main.
First PR Conversion
Rate at which developers submitting their first repository PR succeed.
Show contributors that your repository actively reviews and merges external pull requests.
[](https://getmerged.abhishekco.de/openai/codex-security?utm_source=github&utm_medium=badge)
Historical health & responsiveness evolution
External PR acceptance
First PR success rate
50% receive response in
90% receive response in
Maintainer review activity heatmap & prime window prediction
Calculating local time...
Calculating local time...
Detected: UTC
Maintainers are most responsive around 23:00 UTC (23:00 UTC in your timezone). Recommended submission window is Wednesday - Friday from 21:00 to 01:00 UTC (21:00 - 01:00 UTC local).
Maintainer Strategy: Maintainer Sweet Spot: PRs under 150 lines merge in ~16 hours (61% approval). Large PRs (>500 lines) take ~115 hours (22% approval). Keep your diff compact for rapid review.
Summary codex-security login status prints POSIX-shell unset guidance on Windows PowerShell when an API-key environment variable overrides a stored ChatGPT sign-in. The diagnostic correctly identifies the overriding variables, but the suggested command is not valid in PowerShell. Affected version and environment Released package: @openai/[email protected] Originally reproduced at commit e94d6bef9797a192febfde89a26ec7f831bc09b2 Confirmed still present on current main at f22d4a36f26d16287bcdfd707b369116e02a08c3 Microsoft Windows NT 10.0.19045.0 PowerShell 7.6.3 Node.js 24.18.0 Steps to reproduce With an existing stored ChatGPT sign-in, run from sdk/typescript: $env:OPENAI_API_KEY = 'SYNTHETIC_NOT_A_REAL_KEY' node .\bin\codex-security.mjs login status Relevant output: Logged in using ChatGPT Effective scan authentication: API key from OPENAI_API_KEY. To use a ChatGPT sign-in, unset OPENAI_API_KEY and CODEX_API_KEY. The same wording is also used when login warns that a configured env
Summary scripts/check-package.mjs rejects a valid npm tarball on Windows when the system tar command emits CRLF line endings for tar -tvzf. The validation uses a multiline regular expression directly on the complete listing. In JavaScript, both CR and LF are line terminators for multiline anchors, so ^ can match between the \r and \n. The following \n is then tested as if it were the first character of a new line and triggers the non-regular-entry error. Affected version and environment Released package: @openai/[email protected] Confirmed still present on current main at f22d4a36f26d16287bcdfd707b369116e02a08c3 Microsoft Windows NT 10.0.19045.0 PowerShell 7.6.3 Node.js 24.18.0 pnpm 11.17.0 bsdtar 3.5.2 / libarchive 3.5.2 Steps to reproduce From the repository root: cd sdk/typescript corepack pnpm install --frozen-lockfile corepack pnpm run build corepack pnpm pack --pack-destination ../../dist node scripts/check-package.mjs ../../dist/openai-codex-security-0.1.1.tgz Observed erro
Rate what actually matters after opening a pull request here.
Rate your first-hand PR experience (review speed, maintainer responsiveness, and onboarding ease) to help other contributors.
When evaluating whether to contribute to openai/codex-security, response velocity and maintainer engagement are crucial. GetMerged continuously tracks pull request trajectories, first-comment latency, and code review rounds to help developers avoid submitting pull requests to backlogged repositories.
Currently, maintainers of openai/codex-security acknowledge new external contributions in approximately 3 hours. Out of all submitted pull requests from non-core authors in the last 180-day window, 48.1% were successfully merged into the primary branch.
openai/codex-security has a recorded first-timer success rate of 18.5%. Repositories ranked Welcoming typically provide actionable feedback during code reviews and actively nurture new community contributors.
The initial maintainer response time averages ~3 hours. Keeping PRs scoped to single concerns and ensuring CI checks succeed will optimize review turnaround.
The C-Rank™ index scores repositories on a 0 to 100 scale using an objective formula: external PR merge rates, initial response speed, active maintainer count, and first-time contributor retention. A score of 63.1 places openai/codex-security in the Welcoming tier.
The external pull request merge rate is 48.1%. GetMerged isolates non-core community contributions so external developers get an accurate benchmark of PR acceptance probability.
openai/codex-security does not have open beginner labels indexed currently, but external PRs for bugs and documentation improvements are evaluated via normal issue triage.
All metrics displayed for openai/codex-security are automatically retrieved via the public GitHub API and recalculated daily. Insider pull requests submitted by repository owners or organization members are excluded from merge rate calculations to preserve objective external contributor statistics.